Parent

Class/Module Index [+]

Quicksearch

Rex::Registry::Hive

Attributes

hive_name[RW]
hive_regf[RW]
root_key[RW]

Public Class Methods

new(hivepath) click to toggle source
# File lib/rex/registry/hive.rb, line 10
def initialize(hivepath)

        hive_blob = open(hivepath, "rb") { |io| io.read }

        @hive_regf = RegfBlock.new(hive_blob)
        return nil if !@hive_regf.root_key_offset

        @root_key = NodeKey.new(hive_blob, 0x1000 + @hive_regf.root_key_offset)
        return nil if !@root_key.lf_record

        keys = []
        root_key.lf_record.children.each do |key|
                keys << key.name
        end

        if keys.include? "LastKnownGoodRecovery"
                @hive_name = "SYSTEM"
        elsif keys.include? "Microsoft"
                @hive_name = "SOFTWARE"
        elsif keys.include? "Environment"
                @hive_name = "NTUSER.DAT"
        elsif keys.include? "SAM"
                @hive_name = "SAM"
        elsif keys.include? "Policy"
                @hive_name = "SECURITY"
        else
                @hive_name = "UNKNOWN"
        end

end

Public Instance Methods

relative_query(path) click to toggle source
# File lib/rex/registry/hive.rb, line 41
def relative_query(path)

        if path == "" || path == "\\"
                return @root_key
        end

        current_child = nil
        paths = path.split("\\")

        return if !@root_key.lf_record

        @root_key.lf_record.children.each do |child|
                next if child.name.downcase != paths[1].downcase

                current_child = child

                if paths.length == 2
                        current_child.full_path = path
                        return current_child
                end

                2.upto(paths.length) do |i|

                        if i == paths.length
                                current_child.full_path = path
                                return current_child
                        else
                                if current_child.lf_record && current_child.lf_record.children
                                        current_child.lf_record.children.each do |c|
                                                next if c.name.downcase != paths[i].downcase

                                                current_child = c

                                                break
                                        end
                                end
                        end
                end
        end

        return if !current_child

        current_child.full_path = path
        return current_child
        end
value_query(path) click to toggle source
# File lib/rex/registry/hive.rb, line 87
        def value_query(path)
                if path == "" || path == "\\"
                return nil
        end

        paths = path.split("\\")

        return if !@root_key.lf_record

        @root_key.lf_record.children.each do |root_child|
                next if root_child.name.downcase != paths[1].downcase

                current_child = root_child

                if paths.length == 2
                        return nil
                end

                2.upto(paths.length - 1) do |i|
                        next if !current_child.lf_record

                        current_child.lf_record.children.each do |c|
                                next if c.name != paths[i]
                                current_child = c

                                break
                        end
                end

                if !current_child.value_list || current_child.value_list.values.length == 0
                        return nil
                end

                current_child.value_list.values.each do |value|
                        next if value.name.downcase != paths[paths.length - 1].downcase

                        value.full_path = path
                        return value
                end
        end
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.